# GitHub Advisory malware sweep, 24 August 2026

> 13 new GHSA CWE-506 advisories in the 24h ending 2026-08-24. Highlights: PyPI `envprovision` drops the **Snow Stealer** infostealer on Windows; `cryptgraphy`+`mlflow-otel-instrumentor` extend the `2026-08-boto4` cryptominer-worm operator with a new campaign brand; npm `@opap/player-kyc-widget` is a targeted probe against Greek gambling operator OPAP.

- Published: 2026-08-24
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm, PyPI
- Scope: 12 packages, 18 compromised versions
- Tags: dependency-confusion, infostealer, credential-theft, typosquat, obfuscation, crypto-wallet-drain, worm
- Also known as: 2026-08-24 GHSA sweep, envprovision Snow Stealer, 2026-08-mlflow-otel-instrumentor cryptominer worm, 2026-08-boto4 operator continuation, fund-* 999.9.12 dep-confusion pair, @opap OPAP KYC dep-confusion, *-dim-kit framework typosquat pair, @sdgdfgdfhhhfd mash-scope crypto viewer pair, conversa-sdk 10-version release, identitysecuretokenserv internal-name dep-confusion
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, kam193
- Incident ID: multi-2026-08-24-ghsa-malware-sweep

## Affected packages (12)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@opap/player-kyc-widget](https://dependencywatch.io/package/npm/@opap/player-kyc-widget) | npm | 3.999.999 |
| [@sdgdfgdfhhhfd/chainvista](https://dependencywatch.io/package/npm/@sdgdfgdfhhhfd/chainvista) | npm |  |
| [@sdgdfgdfhhhfd/multiviewr](https://dependencywatch.io/package/npm/@sdgdfgdfhhhfd/multiviewr) | npm |  |
| [conversa-sdk](https://dependencywatch.io/package/npm/conversa-sdk) | npm | 1.0.0, 1.0.4, 1.0.5, 1.0.6, 1.0.8, 1.0.9, 2.0.0, 2.0.2, 2.0.3, 2.0.4 |
| [cryptgraphy](https://dependencywatch.io/package/pypi/cryptgraphy) | PyPI | 1.0.0 |
| [envprovision](https://dependencywatch.io/package/pypi/envprovision) | PyPI | 1.2.0, 1.3.0, 1.4.0 |
| [fund-list-filter](https://dependencywatch.io/package/npm/fund-list-filter) | npm | 999.9.12 |
| [fund-portfolio](https://dependencywatch.io/package/npm/fund-portfolio) | npm | 999.9.12 |
| [hydration-dim-kit](https://dependencywatch.io/package/npm/hydration-dim-kit) | npm |  |
| [identitysecuretokenserv](https://dependencywatch.io/package/npm/identitysecuretokenserv) | npm |  |
| [mlflow-otel-instrumentor](https://dependencywatch.io/package/pypi/mlflow-otel-instrumentor) | PyPI | 1.1.0 |
| [svelte-dim-kit](https://dependencywatch.io/package/npm/svelte-dim-kit) | npm |  |

## What happened

The 24-hour window ending 2026-08-24 06:00 UTC published **6 new GHSA CWE-506 advisories on npm** and **3 on PyPI**, plus catch-up entries for 4 npm advisories dated 2026-08-23 that landed after the previous sweep window closed. Two things about this batch matter beyond the usual sweep noise: (1) `envprovision` ships a named Windows infostealer (**Snow Stealer**) that modifies cryptowallet binaries and self-cleans logs; (2) the `cryptgraphy`+`mlflow-otel-instrumentor` pair carries the **identical VT file hash** as - and is explicitly labelled a continuation of - the [`boto4` cryptominer worm](https://dependencywatch.io/incident/multi-2026-08-22-ghsa-malware-sweep) from 48h earlier, confirming that operator is running fresh brand rotations to survive takedowns.

## Cluster A - PyPI `envprovision` Snow Stealer Windows infostealer (1 package, 3 versions)

| Package | Versions | GHSA | Source hash | VT file hash | Payload |
|---|---|---|---|---|---|
| `envprovision` | `1.2.0, 1.3.0, 1.4.0` | GHSA-xr9j-7gjp-x8fg | `cf3a48b4…d869` | `d49fa539…b878` | Snow Stealer |

Windows-only dropper hidden inside **exported library functions** (not a top-level `os.system()`, so a shallow static scan misses it). On import the package downloads a remote executable, saves it under a system-utility-looking filename, then **cleans logs and deletes the downloaded stager** to defeat forensic recovery. The dropped payload is identified as **Snow Stealer** - a Windows infostealer with three defining behaviours: enumeration of browser saved-password / cookie / autofill stores (Chrome, Edge, Brave, Firefox); **modification of cryptocurrency wallet application binaries** so subsequent transaction-signing flows can be tampered post-compromise; and **sandbox-evasion checks** (process list, mouse-heuristics, VM registry-tell keys) that make dynamic analysis fight the sample. Any Windows host that installed the package needs re-imaging plus wallet-key rotation - browser store rotation is not sufficient because the wallet binary itself has been tampered.

## Cluster B - PyPI `cryptgraphy` + `mlflow-otel-instrumentor` cryptominer worm - `2026-08-boto4` operator continuation (2 packages)

| Package | Versions | GHSA | Source hash | VT file hash | Campaign |
|---|---|---|---|---|---|
| `cryptgraphy` | `>=1.0.0` | GHSA-2v43-g59q-gxp6 | `d303a7fa…3a1a` | `051f8704…12e9` | `2026-08-mlflow-otel-instrumentor` (linked to `2026-08-boto4`) |
| `mlflow-otel-instrumentor` | `>=1.1.0` | GHSA-w427-8xgw-fvcw | `596b37ce…0bbf` | `051f8704…12e9` | `2026-08-mlflow-otel-instrumentor` (linked to `2026-08-boto4`) |

**Both packages ship the same executable** (identical VT file hash `051f8704…12e9`). The advisories explicitly note the campaign shares similarities with the [`2026-08-boto4` cryptominer worm](https://dependencywatch.io/incident/multi-2026-08-22-ghsa-malware-sweep) from 48h earlier. Payload behaviours:

- **persistence via systemd services** (Linux-native - the operator is targeting build servers and Linux dev hosts, not developer Windows laptops)
- **cryptomining** (XMR-shape based on the shared operator lineage)
- **worm-style propagation over the local network** (see [`boto4` writeup](https://dependencywatch.io/incident/multi-2026-08-22-ghsa-malware-sweep) for the shared shape - it enumerates the local subnet and attempts to spread laterally)

The two typosquat targets are notable for dictionary discipline: `cryptography` is the pyca crypto library (a foundational transitive dependency for anything doing TLS in Python), and `mlflow` + `opentelemetry` maps to a plausible-sounding integration package that an ML engineer might install without a second look. This is the third distinct brand this operator has shipped in seven days (`libasync` 2026-08-20 → `boto4` 2026-08-22 → `cryptgraphy`/`mlflow-otel-instrumentor` 2026-08-23). Expect a fresh brand within days.

## Cluster C - npm `fund-*` 999.9.12 dep-confusion beacon pair (2 packages)

| Package | Versions | GHSA | Hash | Notes |
|---|---|---|---|---|
| `fund-list-filter` | `999.9.12` | GHSA-ww7v-m7hw-7m2q | `d7cde5bd…8281` | "communicates with a domain" |
| `fund-portfolio` | `999.9.12` | GHSA-8qph-p7jr-c2xf | `ffad2f6c…03bf` | "communicates with a domain" |

Shared `999.9.12` dep-confusion sentinel version. Fund-industry naming (`fund-list-filter`, `fund-portfolio`) suggests a targeted probe against a specific asset-management or fintech internal registry. GHSA does not publish the callback domain per package, but the shared version + shared advisory shape confirms a single operator running a two-package catchment. The `999.9.x` sentinel pattern also appears in the [`stillm4ddpocs-*` cluster from 2026-08-23](https://dependencywatch.io/incident/multi-2026-08-23-ghsa-malware-sweep) and the [`lumen-pages-community@9.9.9` beacon from 2026-08-22](https://dependencywatch.io/incident/multi-2026-08-22-ghsa-malware-sweep) - dep-confusion probing is running at a steady 1-3 packages per day across multiple operators.

## Cluster D - npm `@opap/player-kyc-widget` OPAP-targeted KYC dep-confusion (1 package)

| Package | Versions | GHSA | Hash | Target |
|---|---|---|---|---|
| `@opap/player-kyc-widget` | `<=3.999.999` | GHSA-w2m6-3q96-chrf | `98e627ce…6885` | OPAP (Greek regulated gambling operator) KYC pipeline |

Highly targeted. `@opap` reads as OPAP (Organisation of Football Prognostics S.A., Greece's dominant regulated gambling operator - sports betting, lottery, casino). `player-kyc-widget` implies a Know-Your-Customer identity-verification UI component - the exact flow that receives customer identity documents, selfies, and bank-account details during onboarding. The `<=3.999.999` version pattern is the classic dep-confusion sentinel: any OPAP resolver misconfigured to prefer highest-version-across-registries picks the public tarball over any lower-versioned internal `@opap/player-kyc-widget`.

Advisory notes the package "communicates with a domain associated with malicious activity" but does not publish the specific callback. Any successful catchment gives the operator a live foothold inside the KYC pipeline of a regulated gambling operator - unredacted customer PII, ID document images, and session cookies for the KYC verifier are all in reach. If this catches, the regulatory disclosure obligations (Greek DPA / GDPR / EU gambling regulator) start counting from the catchment date, not the discovery date.

## Cluster E - npm `*-dim-kit` framework-adjacent typosquat pair (2 packages)

| Package | Versions | GHSA | Note |
|---|---|---|---|
| `hydration-dim-kit` | `>=0` | GHSA-p33f-w7x3-mxrr | Boilerplate CWE-506, no per-package IOCs |
| `svelte-dim-kit` | `>=0` | GHSA-64x3-8jmm-fhp8 | Boilerplate CWE-506, no per-package IOCs |

Same `-dim-kit` suffix, same publication day, same boilerplate advisory shape - single operator running a two-shot typosquat register against SSR/hydration-adjacent dev tooling. Names read as React/Next.js and Svelte hydration helpers. No runtime IOCs published; treat as full RCE against any host that installed either.

## Cluster F - npm `@sdgdfgdfhhhfd/*` mash-scope crypto-viewer pair (2 packages)

| Package | Versions | GHSA | Note |
|---|---|---|---|
| `@sdgdfgdfhhhfd/multiviewr` | `>=0` | GHSA-wwgv-4qvc-7339 | Boilerplate CWE-506, no per-package IOCs |
| `@sdgdfgdfhhhfd/chainvista` | `>=0` | GHSA-849m-c6hc-74xx | Boilerplate CWE-506, no per-package IOCs |

The scope `@sdgdfgdfhhhfd` is a keyboard-mash disposable throwaway - no legitimate publisher owns that scope. Package names (`multiviewr` = crypto multi-viewer, `chainvista` = blockchain viewer) target **crypto-wallet users** searching for portfolio-tracking UIs. Same operator across both slugs. Any host that installed either should treat wallet keys as leaked. This mash-scope publishing pattern is a common takedown-evasion trick: after the two slugs are yanked, the operator drops a fresh mash-scope tomorrow with two more slugs, and a scanner keyed to `@sdgdfgdfhhhfd` misses it.

## Cluster G - npm `conversa-sdk` 10-version release (1 package)

| Package | Versions | GHSA | Note |
|---|---|---|---|
| `conversa-sdk` | `1.0.0, 1.0.4, 1.0.5, 1.0.6, 1.0.8, 1.0.9, 2.0.0, 2.0.2, 2.0.3, 2.0.4` | GHSA-8m82-6fp4-38m4 | Boilerplate CWE-506, no per-package IOCs |

**Ten affected versions across a 1.x and 2.x release train** is diagnostic: either (a) an established package whose maintainer account was compromised and all releases were republished with malware inserted, or (b) a long-running typosquat of a real "conversa" chatbot/CX SDK where the operator kept version-bumping to catch scanners tracking a specific version. GHSA published no runtime IOCs. Any host that installed **any** listed version should be treated as fully compromised; scope by comparing install date against the affected-version publish dates.

## Cluster H - npm `identitysecuretokenserv` internal-name dep-confusion pull (1 package)

| Package | Versions | GHSA | Note |
|---|---|---|---|
| `identitysecuretokenserv` | `>=0` | GHSA-2g7g-rqj2-26hv | Boilerplate CWE-506, no per-package IOCs |

The slug `identity` + `secure` + `token` + `serv` matches the fingerprint of an **internal-microservice-name dep-confusion probe** - the operator guessed a plausible internal package name and squatted it public. Boilerplate CWE-506, no IOCs. Treat as full RCE against any private-registry proxy that ever fell through to public with a matching internal name.

## Registry state

All 13 packages yanked from their respective registries during the 2026-08-24 takedown window. Private mirrors that cached tarballs before takedown will keep serving them.

## Related tracked activity

- **`2026-08-boto4` PyPI cryptominer-worm operator** (Cluster B): now on brand rotation - `libasync` [2026-08-20](https://dependencywatch.io/incident/multi-2026-08-20-ghsa-malware-sweep) → `boto4` [2026-08-22](https://dependencywatch.io/incident/multi-2026-08-22-ghsa-malware-sweep) → `cryptgraphy`/`mlflow-otel-instrumentor` (this file). Same worm + miner shape, same operator, fresh brand every 24-48h.
- **`999.9.x` dep-confusion sentinel-version pattern** (Cluster C): also seen in [`stillm4ddpocs-*` 2026-08-23](https://dependencywatch.io/incident/multi-2026-08-23-ghsa-malware-sweep) and [`lumen-pages-community@9.9.9` 2026-08-22](https://dependencywatch.io/incident/multi-2026-08-22-ghsa-malware-sweep).
- **`@opap/*` scope targeting** (Cluster D): first appearance of OPAP as a dep-confusion target on any tracked ecosystem. If you operate in the EU regulated-gambling space, review your private-scope hygiene against all major operators (Bet365, William Hill, Betsson, OPAP, Stoiximan) - these scopes are cheap to squat.
- Discovery credits: `GitHub Advisory Database`, `OpenSSF malicious-packages`, `OpenSSF Package Analysis`, `kam193`. No named threat actor.

## Impact

- **Cluster A - PyPI `envprovision` Snow Stealer Windows infostealer (2026-08-24, 3 versions)**: `envprovision@1.2.0, 1.3.0, 1.4.0` (GHSA-xr9j-7gjp-x8fg, source hash `cf3a48b4…d869`, VT file hash `d49fa539…b878`, campaign `Snow Stealer`). Windows-specific dropper. Malicious functionality hidden inside exported library functions so a defender scanning for a top-level `os.system()` misses it. On import (Windows only): downloads and installs a remote executable, **disguises it as a system utility** so a casual `msconfig` / Task Manager review misses it, then **cleans logs and removes the downloaded stager** to defeat forensic recovery. Payload identified as **Snow Stealer** - a Windows infostealer that (a) enumerates browser data (Chrome, Edge, Brave, Firefox saved logins, cookies, autofill), (b) **modifies cryptowallet application binaries** so subsequent transaction-signing flows leak keys, (c) implements **multiple sandbox-evasion checks** (process list, mouse-movement heuristics, VM-tell registry keys) so dynamic analysis has to actively fight the sample. Any Windows host that ran `pip install envprovision` needs re-imaging plus wallet-key rotation before restoring
- **Cluster B - PyPI `cryptgraphy`+`mlflow-otel-instrumentor` cryptominer worm - `2026-08-boto4` operator continuation (2026-08-23, 2 packages)**: `cryptgraphy@>=1.0.0` (GHSA-2v43-g59q-gxp6, source hash `d303a7fa…3a1a`, VT file hash `051f8704…12e9`), `mlflow-otel-instrumentor@>=1.1.0` (GHSA-w427-8xgw-fvcw, source hash `596b37ce…0bbf`, VT file hash `051f8704…12e9` **identical to cryptgraphy**, campaign `2026-08-mlflow-otel-instrumentor`, explicit similarity to `2026-08-boto4`). Both packages ship the **same** downloaded executable (identical VT file hash) so a scanner that flagged `boto4` earlier this week should already be tuned for this file. Payload targets: (1) **persistence via systemd services** (Linux-native, not Windows Run keys - so this is targeting build/deploy Linux hosts, not developer laptops), (2) **XMR-shape cryptomining**, (3) **worm-style propagation over the local network** (see [boto4 2026-08-22](https://dependencywatch.io/incident/multi-2026-08-22-ghsa-malware-sweep) for the shared worm shape). Two typosquat targets: `cryptography` (the widely-used pyca crypto library) and `mlflow` + `opentelemetry` (a plausible extension to the mlflow tracing story). The naming discipline (real ecosystem name + real adjacent tech) points to an operator with dictionary preparation, not opportunistic spray
- **Cluster C - npm `fund-*` 999.9.12 dep-confusion beacon pair (2026-08-23, 2 packages)**: `fund-list-filter@999.9.12` (GHSA-ww7v-m7hw-7m2q, hash `d7cde5bd…8281`), `fund-portfolio@999.9.12` (GHSA-8qph-p7jr-c2xf, hash `ffad2f6c…03bf`). Both share the **`999.9.12` dep-confusion sentinel version** and the boilerplate "The package communicates with a domain associated with malicious activity" indicator. Fund-industry naming (`fund-list`, `fund-portfolio`) points to a targeted probe against a specific asset-management or fintech internal registry - any resolver misconfigured to prefer highest-version-across-registries picks the public tarball over a lower-versioned internal one. GHSA does not publish the specific callback domain per package, but the shared version pattern + shared advisory shape confirms a single operator running a two-package catchment probe
- **Cluster D - npm `@opap/player-kyc-widget` OPAP (Greek gambling operator) targeted KYC dep-confusion (2026-08-23, 1 package)**: `@opap/player-kyc-widget@<=3.999.999` (GHSA-w2m6-3q96-chrf, hash `98e627ce…6885`). **Highly targeted**: the `@opap` scope reads as OPAP (Organisation of Football Prognostics S.A., Greece's dominant regulated gambling operator - sports betting, lottery, casino). `player-kyc-widget` implies a **Know-Your-Customer identity-verification UI component** - the exact flow that receives customer ID documents, selfies, and bank-account references during onboarding. The `<=3.999.999` version pattern is the classic dep-confusion sentinel: any OPAP resolver misconfigured to prefer highest-version-across-registries picks the public tarball over any lower-versioned internal `@opap/player-kyc-widget`. Advisory notes "the package communicates with a domain associated with malicious activity" but does not publish the specific callback. Any successful catchment gives the operator a live foothold inside the KYC pipeline of a regulated gambling operator - the payoff on a follow-up payload would be direct access to unredacted customer PII and possibly session cookies for the KYC verifier
- **Cluster E - npm `*-dim-kit` framework-adjacent typosquat pair (2026-08-23, 2 packages)**: `hydration-dim-kit@>=0` (GHSA-p33f-w7x3-mxrr, no per-package IOCs), `svelte-dim-kit@>=0` (GHSA-64x3-8jmm-fhp8, no per-package IOCs). Both are boilerplate CWE-506 pulls where GHSA published only the standard "considered fully compromised" text. Naming reads as **framework hydration helpers**: `hydration-dim-kit` (React/Next.js SSR hydration), `svelte-dim-kit` (Svelte SSR). The shared `-dim-kit` suffix + same publication day strongly suggests a single operator running a two-shot typosquat register against SSR-adjacent dev tooling. Treat as full RCE against any host that installed either
- **Cluster F - npm `@sdgdfgdfhhhfd/*` mash-scope disposable-operator pair (2026-08-23, 2 packages)**: `@sdgdfgdfhhhfd/multiviewr@>=0` (GHSA-wwgv-4qvc-7339, no per-package IOCs), `@sdgdfgdfhhhfd/chainvista@>=0` (GHSA-849m-c6hc-74xx, no per-package IOCs). The scope `@sdgdfgdfhhhfd` is a **keyboard-mash disposable throwaway** - no legitimate publisher owns that scope, and the pattern (`multiviewr` = crypto multi-viewer, `chainvista` = blockchain viewer) targets **crypto-wallet users** searching for portfolio-tracking UIs. Boilerplate CWE-506 pulls, no per-package IOCs published. Same operator across both slugs. Any host that installed either should treat wallet keys as leaked
- **Cluster G - npm `conversa-sdk` 10-version maintainer-takeover or long-form typosquat (2026-08-24, 1 package)**: `conversa-sdk@1.0.0, 1.0.4, 1.0.5, 1.0.6, 1.0.8, 1.0.9, 2.0.0, 2.0.2, 2.0.3, 2.0.4` (GHSA-8m82-6fp4-38m4, no per-package IOCs). **Ten affected versions spanning both a 1.x and a 2.x release train** is the fingerprint of either (a) an established package whose maintainer was compromised and all releases republished with malware, or (b) a long-running typosquat of a real "conversa" chatbot/CX SDK where the operator kept version-bumping to catch scanners tracking a specific version. GHSA published no per-package IOCs. Treat every host that installed any listed version as fully compromised, and check publish dates on the affected versions against your first-install date to scope exposure
- **Cluster H - npm `identitysecuretokenserv` internal-name dep-confusion pull (2026-08-24, 1 package)**: `identitysecuretokenserv@>=0` (GHSA-2g7g-rqj2-26hv, no per-package IOCs). The slug (`identity` + `secure` + `token` + `serv` = "identity secure token server") matches the fingerprint of an **internal-microservice-name dep-confusion probe** - the operator guessed a plausible internal package name that some organisation might publish to a private scope, and squatted it public so a misconfigured resolver picks the public one. Boilerplate CWE-506 pull, no IOCs. Treat as full RCE against any private-registry proxy that ever fell through to public with a matching internal name

## What to do

1. Grep every lockfile (`package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, `requirements.txt`, `Pipfile.lock`, `poetry.lock`, `uv.lock`) for: `envprovision`, `cryptgraphy`, `mlflow-otel-instrumentor`, `fund-list-filter`, `fund-portfolio`, `@opap/player-kyc-widget`, `hydration-dim-kit`, `svelte-dim-kit`, `@sdgdfgdfhhhfd/multiviewr`, `@sdgdfgdfhhhfd/chainvista`, `conversa-sdk`, `identitysecuretokenserv`
2. **For Cluster A (`envprovision` Snow Stealer)**: any Windows host that ran `pip install envprovision` needs to be **re-imaged** - the dropper cleans its own logs, so post-hoc forensic recovery is unreliable. Before rebuilding, rotate every credential in every browser saved-password store, every cryptocurrency wallet seed, every VPN cred, every SSH key on the host. If the host holds hot wallets, **assume funds are drained** - transfer any remaining balance to a fresh wallet generated on a known-clean machine. Add the VT file hash `d49fa539…b878` to endpoint AV / EDR blocklists. The Snow Stealer family also **modifies wallet application binaries** so any wallet software installed after the compromise cannot be trusted - reinstall from vendor sources
3. **For Cluster B (`cryptgraphy` + `mlflow-otel-instrumentor`)**: uninstall from every virtualenv and CI pipeline. Because the payload propagates worm-style across the local network (shared shape with [`boto4` 2026-08-22](https://dependencywatch.io/incident/multi-2026-08-22-ghsa-malware-sweep)), **isolate the L2 segment before rebuilding**: check every other host on the same subnet for the same VT file hash `051f8704…12e9`. Persistence lives in `systemd` unit files on Linux - `systemctl list-unit-files --state=enabled | grep -v '/lib/systemd'` for enabled units in unexpected paths (`/tmp`, `/var/tmp`, `~/.config/systemd/user`, `/etc/systemd/system/*.service` added in the last 7 days); disable and delete any that reference an executable in a user or tmp directory. If Nvidia GPUs are attached to the host, check GPU utilisation and process list - the cryptominer will show sustained non-zero GPU load without a matching workload
4. **For Cluster C (`fund-list-filter` + `fund-portfolio`)**: if you operate a private npm registry with a `fund-*` scope, **lock your private-registry proxy to explicit-scope-only resolution** so a `999.9.12` public tarball cannot beat your internal semver. Audit the private-registry logs for other `fund-*` resolutions in the last 90 days. The `999.9.x` sentinel-version pattern also matches the [`stillm4ddpocs-*` cluster from 2026-08-23](https://dependencywatch.io/incident/multi-2026-08-23-ghsa-malware-sweep) and the [`lumen-pages-community@9.9.9` beacon from 2026-08-22](https://dependencywatch.io/incident/multi-2026-08-22-ghsa-malware-sweep) - if your registry has been surveyed by multiple `999.x.x` probes, treat it as an active dep-confusion catchment and audit your recent installs
5. **For Cluster D (`@opap/player-kyc-widget`)**: if you operate near OPAP infrastructure or use any `@opap/*` scope in a private registry, **lock private-registry resolution to explicit-scope-only** immediately - the version pattern `<=3.999.999` is designed to beat any legitimate `3.x`/`4.x` internal version. Audit private-registry logs for **any** `@opap/*` resolutions in the last 90 days from outside the corporate egress; treat any match as evidence of a successful dep-confusion catch. Because the target is a KYC pipeline, factor **regulatory disclosure obligations** (Greek DPA / GDPR / EU gambling regulator) into the incident response if a customer-data path is affected
6. **For Cluster E (`*-dim-kit`)**: uninstall from every project. Because GHSA published no runtime IOCs, monitor egress from any host that installed either package for outbound connections to previously-unseen domains for at least 30 days
7. **For Cluster F (`@sdgdfgdfhhhfd/*`)**: uninstall. Watch for republishes under adjacent throwaway scopes - a mash-scope operator that publishes two packages under one scope is trivially rebuildable under another mash-scope for the next batch
8. **For Cluster G (`conversa-sdk`)**: uninstall every listed version. Because ten versions across two release trains are affected, check your **install timeline**: any version pulled between the first affected release and today should be treated as compromised. Rotate credentials the install shell could reach; if the package was consumed at runtime by a customer-facing service, rebuild from the last known-clean version (which may be prior to the entire affected range if this is a maintainer takeover)
9. **For Cluster H (`identitysecuretokenserv`)**: block at your registry proxy. Because the name matches an internal-microservice fingerprint, audit any private-registry `identity*` or `*-token-serv*` resolutions from outside the corporate egress in the last 90 days
10. For all npm installs in CI, run with `--ignore-scripts` where possible - though for Clusters C/D/G, the payload may fire on `require()`/`import` rather than lifecycle hooks, so `--ignore-scripts` alone is insufficient. For all `pip install` runs, prefer `--only-binary=:all:` (Clusters A and B both ship native/executable stagers so binary-only is not automatically safe) and pin transitive dependencies from a curated allow-list
11. Verify none of these packages still resolves via your private mirror - internal caches routinely keep serving yanked tarballs after the public takedown

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GHSA-xr9j-7gjp-x8fg - envprovision (PyPI Snow Stealer Windows infostealer)](https://github.com/advisories/GHSA-xr9j-7gjp-x8fg) - GitHub
- [GHSA-2v43-g59q-gxp6 - cryptgraphy (PyPI cryptominer + worm, 2026-08-boto4 operator continuation)](https://github.com/advisories/GHSA-2v43-g59q-gxp6) - GitHub
- [GHSA-w427-8xgw-fvcw - mlflow-otel-instrumentor (PyPI cryptominer + worm, identical payload to cryptgraphy)](https://github.com/advisories/GHSA-w427-8xgw-fvcw) - GitHub
- [GHSA-ww7v-m7hw-7m2q - fund-list-filter (npm 999.9.12 dep-confusion beacon)](https://github.com/advisories/GHSA-ww7v-m7hw-7m2q) - GitHub
- [GHSA-8qph-p7jr-c2xf - fund-portfolio (npm 999.9.12 dep-confusion beacon)](https://github.com/advisories/GHSA-8qph-p7jr-c2xf) - GitHub
- [GHSA-w2m6-3q96-chrf - @opap/player-kyc-widget (npm OPAP-targeted KYC dep-confusion)](https://github.com/advisories/GHSA-w2m6-3q96-chrf) - GitHub
- [GHSA-p33f-w7x3-mxrr - hydration-dim-kit (npm framework typosquat)](https://github.com/advisories/GHSA-p33f-w7x3-mxrr) - GitHub
- [GHSA-64x3-8jmm-fhp8 - svelte-dim-kit (npm framework typosquat)](https://github.com/advisories/GHSA-64x3-8jmm-fhp8) - GitHub
- [GHSA-wwgv-4qvc-7339 - @sdgdfgdfhhhfd/multiviewr (npm mash-scope crypto viewer)](https://github.com/advisories/GHSA-wwgv-4qvc-7339) - GitHub
- [GHSA-849m-c6hc-74xx - @sdgdfgdfhhhfd/chainvista (npm mash-scope crypto viewer)](https://github.com/advisories/GHSA-849m-c6hc-74xx) - GitHub
- [GHSA-8m82-6fp4-38m4 - conversa-sdk (npm 10-version compromised release)](https://github.com/advisories/GHSA-8m82-6fp4-38m4) - GitHub
- [GHSA-2g7g-rqj2-26hv - identitysecuretokenserv (npm internal-name dep-confusion pull)](https://github.com/advisories/GHSA-2g7g-rqj2-26hv) - GitHub
- [GitHub Advisory Database - recent npm malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Anpm&sort=published-desc) - GitHub
- [GitHub Advisory Database - recent pip malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Apip&sort=published-desc) - GitHub
- [Related: 2026-08-22 sweep (boto4 Telegram-C2 miner + worm, same operator as Cluster B)](https://github.com/advisories/GHSA-ffh8-mpww-qp8g) - GitHub

---

Canonical page: https://dependencywatch.io/incident/multi-2026-08-24-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/multi-2026-08-24-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).